The Lower Saxony data protection authority (LfD Niedersachsen) is conducting an inspection at a bank testing pilot data processing processes. In its press release, the authority warns other banks against profiling for advertising purposes. The authority’s findings so far have prompted it to issue a warning to other banks in Lower Saxony.
Profiling has been used to prepare targeted advertising through the use of payment transaction data as well as customer living environment data obtained from external service providers. LfD Niedersachsen noted that such processing activities are unlawful because they cannot be justified either by the legitimate interests of the data controller or by the consent collection forms used by the bank. The bank’s customers cannot decide for themselves whether and which specific data processing is carried out and can only give general consent to profiling for advertising purposes, without being able to control the extent to which this happens. Meanwhile, the behavioural analysis tested by the bank is very broad in scope.
Lower Saxony banks are obliged to include a disclaimer with regard to their operations on customers’ personal data.